EU AI Act: AI Omnibus formally adopted

The AI Act’s core obligations on providers and deployers of high-risk AI systems were due to become applicable in August 2026. The AI Omnibus extends these deadlines until:

• 2 December 2027 for standalone high-risk AI systems; and
• 2 August 2028 for high-risk AI systems embedded in products.

The AI Act contains transparency or “watermarking” obligations for AI systems placed on the market before 2 August 2026. These obligations become applicable on that date, but the AI Omnibus provides a grace period until 2 December 2026.

The Commission proposed extending the right to process special category data (as defined in the GDPR) for the purpose of ensuring bias detection and correction (which is currently limited to providers of high-risk AI systems where it is strictly necessary) to deployers of high-risk systems and models and providers and deployers of other types of AI systems. The final version of the AI Omnibus is in line with this proposal, provides that this right applies exceptionally, and includes safeguards that must be put in place.

The AI Omnibus introduces a ban on AI systems that either have the purpose of generating non-consensual intimate imagery and child sexual abuse material or do not have in place reasonable safety measures to prevent this. The prohibition also applies to deployers using AI systems to create such content. This addresses a regulatory gap highlighted by recent scandals in which AI models produced sexualised images of real people, including minors, as a product feature. The ban will take effect on 2 December 2026.

The AI Omnibus tackles the overlapping requirements of the AI Act and sector-specific laws. Machinery is excluded from the direct application of the AI Act in cases where there is overlap, with health and safety matters being addressed directly under the Machinery Regulation. For other sector-specific laws, e.g. those applicable to medical devices, connected vehicles and toys, the Commission will issue implementing acts.

The Commission proposed an exemption from the obligation for providers to register AI systems in the database for high-risk AI systems where the system does not pose a significant risk of harm to health, safety or fundamental rights. The final version of the Digital Omnibus reinstates the registration obligation, but streamlines the content required, removing the need to provide details of the system’s status and a scanned copy of the certificate issued by the relevant conformity assessment body.

The Commission proposed moving the duty for AI providers and deployers to ensure AI literacy among their staff (which became applicable in February 2025) from the organisation itself to the EU and national authorities. The final version of the AI Omnibus amends the AI Act to require providers and deployers to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, but explicitly states that this obligation does not require them to guarantee any specific level of AI literacy of any individual. The Commission and EU member states are obliged to support and facilitate providers and deployers to fulfil their obligations.

The AI Omnibus extends some of the exemptions from the AI Act’s obligations currently applicable to SMEs to SMCs (small mid-cap entities). 

The AI Omnibus clarifies the respective competences of the AI Office and national authorities for the supervision of AI systems based on general-purpose AI models.